2 domains, 2 servers, 2 web servers - 1 public IP

paulie420, 11 months ago

Everyone here is awesome for ALL the replies. :P Thank you!!

I decided to try a Cloudflared tunnel, but that didn't work out because I can't get the main domain1.com domain to go thru the tunnel... only 'apps', like blog.domain1.com. :P

And, I'm still ironing out how to pass nginx to another local IP on my network; I just haven't gotten it to click yet. All the info needed is right here - I promise to come back when I iron out the setup and post how I managed to do it...

I can figure out how to pass nginx [or apache2, for that matter] to another PORT on the same local IP - I think I have both domains listening on ports 80/443 - and I'll have to change that in order to route the data correctly... let alone getting out to another local IP.

Again appreciate all the info - sometimes I just have to learn a bit more since I have all the documents right here. :P

paulie420, 11 months ago

LOL... it'll be easy, I tell ya!

So I dove in this afternoon, thinking I had all the info I needed to easily get a setup w0rking... I changed my port forwards to the domain2.com machine - the one running apache2 on a webiste; leaving the bitwarden.domain1.com not seeing traffic. Then, I created a new virtual host file on the domain2.com machine;

cat bitwarden.domain1.com.conf

<VirtualHost *:80>

    ServerName bitwarden.domain1.com

    ProxyPass / http://10.0.0.155/ nocanon

    ProxyPassReverse / http://10.0.0.155/

    ServerAdmin paulie420@domain1.com

ErrorLog ${APACHE_LOG_DIR}/error.log

CustomLog ${APACHE_LOG_DIR}/access.log combined

RewriteEngine on

RewriteCond %{SERVER_NAME} =bitwarden.domain1.com

RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]

And ran certbot to get https certs - certification would only be on the domain2.com machine; all proxied data would be sent over http, but I figured that was OK as its just me accessing the domain1.com service.

BUT alas, the setup didn't work; I have some suspicions... bitwarden is running inside a docker container, so... I dunno if that has something to do with how its listening, and its running nginx; what I thought was that apache2 would simply send all traffic from the bitwarden.domain1.com domain over to my local IP 10.0.0.155 machine and that machine would just pick it up simple pimple and display to the user going to that domain. Another thought - maybe its because Docker/Bitwarden HAS https in that container - ohhhh, thats a thought; however it still didn't function correctly before I ran certbot on the domain2.com setup.

UGH... more to come - I'm trying options. :/ Grrrrrr. :P

PS; posting code in Lemmy doesn't work so great, does it? I used a backtick but didn't get the results I'm accustomed to...

alyaza, 11 months ago

PS; posting code in Lemmy doesn’t work so great, does it? I used a backtick but didn’t get the results I’m accustomed to…

it might be because lemmy uses commonmark instead of regular markdown, so the formatting is slightly different from... most markdown things, i guess?

paulie420, 11 months ago

Thanks for the three replies so far; BTW, Lemmy is beating out /r/eddit on this thread!!! :P

Yea, I know that I'm needing a reverse proxy - it was just how to implement one since the two sites aren't using the same host software; apache2 and nginx... so I think I should run a 3rd VM and route the traffic out to the other 2 local IPs; OR condense the two sites into one VM - which I don't really want to do...

Or, maybe I pick a [free, paid if needed] Cloudflare tunnel for the lesser used site - and only have to forward to one VM from my IP.

I guess one more solution would be switching the apache2 over to nginx - can I route to a separate local IP from nginx reverse proxies??? Will research...

Thanks for thinking this thru with me - and I'll keep checking back for other suggestions. :P Appreciated!

mallias, 11 months ago

I'll give you an example of my setup.

Every server has it's own instance of Nginx Proxy Manager (not needed, but helps with using docker networking), then every service I run on docker, I just use docker networks to talk to the rproxy.

My network is designed such that all my externally available services are on one server, so I just forward 80 & 443 to that.

For every other service (not on docker), I just use 127.0.0.1 + port.

For services on other servers on my LAN, I use Internal IP + port.

paulie420, 11 months ago

Understood ; I run all my services on different Proxmox VMs/containers... this isn't usually an issue until two needed the same 80/443 ports... I suppose I could change the ports for my Bitwarden, as I'm the only user connecting [aside from a partner or 2...] and I could modify the links used to connect accordingly.

I feel like I'm missing some EASY thing; like can't my apache2 just route the bitwarden.domain1.com traffic to another local IP address...

All these replies are helping - I just gotta pick the solution and GO; just trying to find the easiest, best solution.. :P

0spkl, 11 months ago

I feel like I'm missing some EASY thing; like can't my apache2 just route the bitwarden.domain1.com traffic to another local IP address...

Yes. It can. https://httpd.apache.org/docs/2.4/vhosts/name-based.html

paulie420, 11 months ago

Thankyou for the link - I'm good at Linux stuff w/ the right info - trust me, I've tried to find this data... :P

Appreciate yer help!

0spkl, 11 months ago

I mean, if you already have nginx OR apache, you could set up a vhost with the other domain name and do a proxy_pass or similar thing to the other one?

They don't need to be the same host software, you'd just need to configure one of them to know how to route it to the other instance. It's just plain HTTP(s) after all.

Reverse proxying is a feature in both nginx and apache after all. Though I'd recommend using nginx for that.

paulie420, 11 months ago

OK ; this reply gets traction with me... YES; I can get either site up; right now the bitwarden.domain1.com is live, and the domain2.com isn't getting ports - but I could switch that around... making domain2.com active/live - then yer saying I could use apache2 vhosts to route bitwarden.domain2.com traffic to a different local IP? Thats exactly what would work easiest for me - I can figure out apache2 vhosts... only I only have experience routing to two sites on the ONE apache2 instance; if I can pass that bitwarden.domain1.com traffic to an external local IP [another proxmox VM running the bitwarden container] that would be perfect.

0spkl, 11 months ago

You could use apache2 vhosts to route bitwarden.domain2.com traffic to wherever the heck you want. Even to another server on the internet.

Think of a vhost as uh... another set of apache server configuration that ONLY applies if the incoming traffic is for that domain/hostname.
That's determined by the Host header in the request, or the TLS SNI value if you're using HTTPS.

Then in that vhost, you'd just configure it like you would any apache instance, like say, for the root location, have it do a proxy_pass, etc.

mallias, 11 months ago

I found Nginx Proxy Manager to be the easiest to configure when I was starting out my homelab! I think the GUI played a big part in that, but it's also just pure NGINX under the hood, so when you get more comfortable with the concepts, you could easily transition to that for even lower overhead (welp, I just had a look at my docker stats, NPM is sitting at 3.2 MB of ram with ~10 proxy hosts, not sure how necessary that even is...)

0spkl, 11 months ago

If you're going to be jumping straight into text based config files.... Caddy's Caddyfile format is a lot easier to work with then nginx configs IMO.

mallias, 11 months ago

Well, I've been self hosting for a few years now, haven't really had the need to jump into a text config for NGINX yet (apart from the rare custom configs some services need, but those are still done in the GUI). Caddy has it's draws, as does traefik, but I think it's easier to learn the concepts with the ease of use a GUI offers!

0spkl, 11 months ago

I mean, yeah. That is true, a GUI would be easier for someone to learn. But once you do, config files are way faster.

Honestly, I first moved to traefik (from caddy) because it let me put my proxy configuration next to the application it's for. (When I was using docker-compose files to manage this.)

mallias, 11 months ago

Yeah, I seriously considered traefik for that convenience alone! When I inevitably outgrow this setup, traefik is the next stop, for sure.

paulie420, 11 months ago

I live mostly on the command line - I'm not afraid to edit .conf files by hand and its how I do most all things - maybe that's why I'm having trouble with this setup!! LOLZ

0spkl, 11 months ago

Cloudflare tunnel free is pretty good, and I use it for my on-prem (in house) services because it can work through CGNAT, though you are subject to the standard cloudflare terms of use.

On the other hand, what you're looking for is called a reverse proxy. I'd recommend Caddy or Nginx Proxy Manager for you.

I personally use Traefik, but I'm also running on a kubernetes cluster so....